linux - executable path is prefixed with "！"：!的含义是 ?

Question

安装motion后：

cat  /lib/systemd/system/motion.service | grep !ExecStartPre=!/bin/mkdir -p /var/log/motionExecStartPre=!/bin/chown motion:adm /var/log/motion

参看手册https://www.freedesktop.org/software/systemd/man/systemd.serv...

"+" If the executable path is prefixed with "+" then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control(5) for the full list.
Similar to the "+" character discussed above this permits invoking command lines with elevated privileges. However, unlike "+" the "!" character exclusively alters the effect of User=, Group= and SupplementaryGroups=, i.e. only the stanzas that affect user and group credentials. Note that this setting may be combined with DynamicUser=, in which case a dynamic user/group pair is allocated before the command is invoked, but credential changing is left to the executed process itself.

阅读了，还是有点不明白，有哪位再详细解释一下？

Answer 1

大概就是这样的，+和!都表示用特权用户(root)执行后面的命令，但是+是-的强化版本，+会忽略PrivateDevices=, PrivateTmp=等等一些权限限制，而!不会忽略。

这里推荐一下金步国翻译的systemd文档：https://www.jinbuguo.com/systemd/systemd.service.html#

做了一个实验：

写了一个service:

[Unit]Description=httpb ServerAfter=network.target[Service]User=abcd          # 使用abcd用户执行这个服务Group=abcdPrivateTmp=true     # 开启私有tmp目录，为了测试ExecStartPre=/usr/bin/whoami       # 不指定参数的情况下查看当前用户，和创建文件 cc.txtExecStartPre=/usr/bin/touch /tmp/cc.txtExecStartPre=!/usr/bin/whoami      # 使用!执行命令和创建文件 aa.txtExecStartPre=!/usr/bin/touch /tmp/aa.txt  ExecStartPre=+/usr/bin/whoami       # 使用+执行命令和创建文件 bb.txtExecStartPre=+/usr/bin/touch /tmp/bb.txtExecStartPre=/usr/bin/ls -lah /tmp   # 不指定参数查看/tmp目录下的文件信息ExecStartPre=+/usr/bin/ls -lah /tmp   # 使用+参数查看/tmp目录下的文件信息ExecStart=/usr/bin/python3 -m http.server 8002   #忽略WorkingDirectory=/opt/httpbRestart=always[Install]WantedBy=multi-user.target

因为文档上说了!号相比+号，少了PrivateTmp这个权限，所以就用PrivateTmp来做实验。

开启了PrivateTmp后，启动的服务，会创建一个临时的/tmp目录，并且挂载在/tmp/systemd-private-bb77789941f8428aa599931e5be5e923-httpb.service-L9w8fg/tmp目录下。

分别写了三组whoami和touch文件，然后使用ls -lah /tmp查看创建的文件。

执行后的结果如下：

Aug 25 16:52:52 debian whoami[25898]: abcdAug 25 16:52:52 debian whoami[25900]: rootAug 25 16:52:52 debian whoami[25902]: rootAug 25 16:52:52 debian ls[25904]: total 8.0KAug 25 16:52:52 debian ls[25904]: drwxrwxrwt  2 root root 4.0K Aug 25 16:52 .Aug 25 16:52:52 debian ls[25904]: drwxr-xr-x 18 root root 4.0K Aug 21 15:33 ..Aug 25 16:52:52 debian ls[25904]: -rw-r--r--  1 root root    0 Aug 25 16:52 aa.txtAug 25 16:52:52 debian ls[25904]: -rw-r--r--  1 abcd abcd    0 Aug 25 16:52 cc.txtAug 25 16:52:52 debian ls[25905]: total 40KAug 25 16:52:52 debian ls[25905]: drwxrwxrwt 10 root root 4.0K Aug 25 16:52 .Aug 25 16:52:52 debian ls[25905]: drwxr-xr-x 18 root root 4.0K Aug 21 15:33 ..Aug 25 16:52:52 debian ls[25905]: drwxrwxrwt  2 root root 4.0K Aug 21 15:28 .ICE-unixAug 25 16:52:52 debian ls[25905]: drwxrwxrwt  2 root root 4.0K Aug 21 15:28 .Test-unixAug 25 16:52:52 debian ls[25905]: drwxrwxrwt  2 root root 4.0K Aug 21 15:28 .X11-unixAug 25 16:52:52 debian ls[25905]: drwxrwxrwt  2 root root 4.0K Aug 21 15:28 .XIM-unixAug 25 16:52:52 debian ls[25905]: drwxrwxrwt  2 root root 4.0K Aug 21 15:28 .font-unixAug 25 16:52:52 debian ls[25905]: -rw-r--r--  1 root root    0 Aug 25 16:52 bb.txtAug 25 16:52:52 debian ls[25905]: drwx------  3 root root 4.0K Aug 21 15:33 systemd-private-bb77789941f8428aa599>Aug 25 16:52:52 debian ls[25905]: drwx------  3 root root 4.0K Aug 25 16:52 systemd-private-bb77789941f8428aa599>Aug 25 16:52:52 debian ls[25905]: drwx------  3 root root 4.0K Aug 21 15:33 systemd-private-bb77789941f8428aa599>Aug 25 16:52:52 debian systemd[1]: Started httpb Server.

没有带参数的ls -lah，只有 aa.txt 和 cc.txt ，没有发现bb.txt
然后有带+的ls -lah，显示了主机/tmp目录下的文件，也看到了bb.txt文件，说明使用+和文档上说明是一致的，会忽略PrivateTmp=这个设置。